If passed, only data pointing to "specific criminal wrongdoing" would be kept longer.

With seemingly unlimited data collection all over the news recently, Michigan's government may soon buck the trend. On Wednesday, State Representative Sam Singh announced a bill that would regulate automatic license plate readers (LPRs) in state, including a mandate that collected data must be deleted within 48 hours unless it's evidence of "specific criminal wrongdoing," according to the Lansing State Journal.

Very few states currently have LPR restrictions, according to the LSJ. For instance, Vermont tosses data after 18 months, and Maine only holds it for 21 days unless data is involved in an investigation. (The paper noted Arkansas, Utah, and Virginia also have some restrictions). New Hampshire is the lone state to ban LPRs outright, and Iowa City made headlines this summer by taking the same approach on a smaller scale. But as Ars discovered when trying to access LPR data as a citizen, often times LPR data can legally be stored indefinitely.

Singh's bill is expected to be formally submitted next week and then considered within the state's legislative process (PDF). Currently, according to The State News, there are no in-state regulations in place to limit how long LPR data is kept.

18 Reader Comments

It's not clear to me whether this only restricts the use of LPRs by the state, or also restricts the use by private parties. If the former, it's a decent start but has a giant loophole built in. If the latter, I am pleased to see it.

It will be really interesting to see if others follow Michigan's example. The issue of how much data can be collected, for what purpose and how long it can be stored is going to be a very hot issue over the coming years and it's about time we had that debate. We wrote up this problem in July here:

Also, upvotes for the bill's prohibition on LPR's taking pictures of vehicle occupants. (However, hold off on uncorking the champagne....this is the same state that just decided there's no prob making 470,000 low-income residents wait several months for healthcare coverage, at a cost of ~$7 million a day in lost funding ;-)

Also, upvotes for the bill's prohibition on LPR's taking pictures of vehicle occupants. (However, hold off on uncorking the champagne....this is the same state that just decided there's no prob making 470,000 low-income residents wait several months for healthcare coverage, at a cost of ~$7 million a day in lost funding ;-)

I'm glad you found a way to weasle in an irrelevant issue, but at least we're expanding Medicaid at all.

This would be relevant to public's perception of the program only, and irrelevant in facts. "Deleted" nowadays means data's removed from live systems where it can be readily queried. Data will still exist in archives and backups and other such locations. It may, may, make a difference in legal cases, if any, because then the data would not be directly admissible. But the authorities would still have the data covertly, and they could base their subsequent investigations on it, and it'd be impossible to prove in court that the subsequent evidence was the fruit off the same tainted tree. In other words: more lies.

This would be relevant to public's perception of the program only, and irrelevant in facts. "Deleted" nowadays means data's removed from live systems where it can be readily queried. Data will still exist in archives and backups and other such locations. It may, may, make a difference in legal cases, if any, because then the data would not be directly admissible. But the authorities would still have the data covertly, and they could base their subsequent investigations on it, and it'd be impossible to prove in court that the subsequent evidence was the fruit off the same tainted tree. In other words: more lies.

Wait, the people who work across the street from me are doing something useful?

Must be a fluke.

You know, I was going to post something along very similar lines, though I don't work where you do. I only live in Michigan. But if these boneheads manage -- surely by accident -- to do something positive and helpful, I might have a heart attack.

I can understand not deleting the images right away to save a little wear and tear on the drives, but I don't understand why the images are not deleted at end of shift.

Heck, I don't really understand why they have to be written to hard drive anyway. Keep the images in ram, compare the plates to known offenders and if it doesn't come back as a positive hit, delete the image from ram, if it does, write it to the drive till they circle around or rescan to confirm that it is a positive hit.

The ACLU is advocating that data retention be measured in "hours or days", not months or years, unless it is specifically related to a criminal investigation. The technology is also available to private companies, so I expect to see websites spring up publishing license numbers observed at adult book stores or strip clubs, and you can get yours removed for a small fee.https://www.aclu.org/alpr

Quote:

Automatic license plate readers have the potential to create permanent records of virtually everywhere any of us has driven, radically transforming the consequences of leaving home to pursue private life, and opening up many opportunities for abuse. The tracking of people’s location constitutes a significant invasion of privacy, which can reveal many things about their lives, such as what friends, doctors, protests, political events, or churches a person may visit.

Automatic license plate readers have the potential to create permanent records of virtually everywhere any of us has driven, radically transforming the consequences of leaving home to pursue private life, and opening up many opportunities for abuse. The tracking of people’s location constitutes a significant invasion of privacy, which can reveal many things about their lives, such as what friends, doctors, protests, political events, or churches a person may visit.

The ACLU is advocating that data retention be measured in "hours or days", not months or years, unless it is specifically related to a criminal investigation. The technology is also available to private companies, so I expect to see websites spring up publishing license numbers observed at adult book stores or strip clubs, and you can get yours removed for a small fee.https://www.aclu.org/alpr

Yeah, that sounds like something a sleazy company would do. Hell, I'm surprised a "Find out which neighbors have bad credit!" site doesn't already exist. I say that without googling first, nobody tell me if such a thing exists.

This is only a bill submitted by a member of the minority party. Apparently Mr. Singh is a Democrat, and the Republicans have strong control over the Michigan legislature this term. I suggest he find a co-sponsor before sending out press releases.

In general, I agree that LPR data should have a short finite lifespan unless its being use for a specific investigation/case. But I'm not sure 48hrs is the right duration.

One of the few legitimate uses I can think of for combing through old LPR data is missing and/or abducted people. Often the police won't even look into this unless the person has been gone 48 hrs. Meaning that by the time someone is officially missing, the data from the last known time/place won't be accessible, necessitating a wider dragnet that both makes the search more difficult and impinges on the privacy of more innocent people.

Well, we've already got debtors prisons, we've just manipulated the people into believing a father who has been fired and is unable to pay child support is a "deadbeat", and that he doesn't deserve rights.